ZP100 not booting

Show first post
This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.

197 replies

S
Userlevel 2
Haven't received the chip from China yet. Replacement, well, there's certainly a technique to replacing a 54 pin SMT chip.
Would love to see some pic.
buzz
Unless you have previous experience reworking SMT boards, this is not the place to start learning. Practice on some discarded electronics first. You'll have a bunch of failed attempts until you hone your technique.
J
Userlevel 2
Ok. I have a zp100 and a bus pirate. I have issues getting connected. The four ports I see are on the network pcb correct? What is the pinout for them vs the bus pirate?
J
Userlevel 2
I get connected and see UART> that is all.
A
Userlevel 2
@johnbcw
go back a little bit in this thread and youll get more info about it
http://forums.sonos.com/showpost.php?p=249346&postcount=62
J
Userlevel 2
I am closer but now the system says read-only file system. That appears to be keeping me from connecting to get the firmware.

Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help.
SDRAM test...
Memory test iteration 0
SDRAM test complete
Attempting to autoboot from NAND device
NAND ID is EC:75
32M NAND flash (Samsung K9F5608U0C) detected
Section 0 is provisionally good, kernel on partition 1, generation 15
Section 1 is provisionally good, kernel on partition 4, generation 14
Attempting to boot kernel from partition 1
(946756120)VFS: Mounted root (cramfs filesystem) readonly.
(946756120)Mounted devfs on /dev
(946756120)Freeing unused kernel memory: 36k freed
(946756120)ttsc/0: 1 input overrun(s)
h(946756121)Empty flash at 0x0061c268 ends at 0x0061c400
(946756121)Empty flash at 0x0061d740 ends at 0x0061d800
(946756121)Empty flash at 0x0061e144 ends at 0x0061e200
(946756121)jffs2_scan_dirent_node(): Node CRC failed on node at 0x0061ebe4: Read 0xffffffff, calculated 0xfe67f4a0
(946756121)Empty flash at 0x0078c6cc ends at 0x0078c800
(946756121)Empty flash at 0x0078d144 ends at 0x0078d200
(946756121)Empty flash at 0x0078e344 ends at 0x0078e400
(946756121)Empty flash at 0x0078edb0 ends at 0x0078ee00
(946756121)Empty flash at 0x0078f630 ends at 0x0078f800
(946756122)jffs2_scan_inode_node(): CRC failed on node at 0x00a5dbe4: Read 0xfff fffff, calculated 0x00cac3a6
(946756122)Empty flash at 0x00a5dd7c ends at 0x00a5de00
(946756122)Empty flash at 0x00a5eb38 ends at 0x00a5ec00
(946756122)jffs2_scan_eraseblock(): Node at 0x00a5f3f8 {0x1985, 0xe002, 0x000000 44) has invalid CRC 0xe0021985 (calculated 0x98f7fb1d)
(946756122)jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00a5f3fc : 0x0044 instead
(946756122)Empty flash at 0x00a5fd44 ends at 0x00a5fe00
(946756122)Empty flash at 0x011a482c ends at 0x011a4a00
(946756122)Empty flash at 0x011a53fc ends at 0x011a5400
(946756122)jffs2_scan_dirent_node(): Name CRC failed on node at 0x011a59d0: Read 0xee69547a, calculated 0xa871cd3d
(946756122)Empty flash at 0x011a5a10 ends at 0x011a5c00
(946756122)Empty flash at 0x011a6f40 ends at 0x011a7000
(946756122)Empty flash at 0x012c05a4 ends at 0x012c0600
(946756122)Empty flash at 0x012c08cc ends at 0x012c0a00
(946756122)Empty flash at 0x012c265c ends at 0x012c2800
(946756122)Empty flash at 0x012c3aa8 ends at 0x012c3c00
(946756123)jffs2_get_inode_nodes(): Data CRC failed on node at 0x012c0688: Read 0x2c55f3e3, calculated 0xd2a2f536
Initializing random number generator...
Using /modules/cifs.o
Using /modules/audiodev.o
(946756123)SCIF-Based Audio Control Interface Initialized
(946756123) at 0xffe80000
(946756123)audioctl: registered.
(946756123)dsp: Initializing DSP ... Complete
(946756123)dsp: registered.
(946756123)jffs2_get_inode_nodes(): Data CRC failed on node at 0x012c02b8: Read 0x376ec35f, calculated 0xe768257c
(946756123)jffs2_get_inode_nodes(): Data CRC failed on node at 0x011a50b4: Read 0xed2df1cc, calculated 0x43e32b19
Using /wifi/ath_hal.o
Warning: loading ath_hal wil(946756124)ath_hal: 0.9.14.4 (AR5212, RF5112, RF2413 )
l taint the kernel: non-GPL license - Proprietary
See http://www.tux.org/lkml/#export-tainted for information about tainted modu les
Using /wifi/ath_driver.o
Warning: loading ath_driver (946756124)PCI: Enabling device PCI device 168c:0013 (0000 -> 0002)
will taint the kernel: no license
See http://www.tux.org/lkml/#export-tainted for information about tainted modu les
(946756124)ath0: registered with power management
(946756124)ath0: Atheros 5212: mem=0xfd000000, irq=8
/usr/sbin/setmac: started
Using MDP s(946756124)ath0: set MAC address to 00:0E:58:10:3D:73
erial number 000E58103D727
Successfully opened socket: 3
Successfully got interface index for if ath0: 3
Current wifi address: 00:02:78:FD:E2:2A
Successfully got i(946756124)eth0: link up, 100Mbps, full-duplex, lpa 0x05E1
nterface index for if eth0: 2
Current ethernet MAC address: 00:E0:4C:00:00:0F
Setting interface eth0 MAC address to 00:0E:58:10:3D:72
Starting internet superserver: inetd(946756125)jffs2_get_inode_nodes(): Data CRC failed on node at 0x00a5fa58: Read 0xc95dbcf1, calculated 0x95178f96
.
PING 169.254.2.2 (169.254.2.2): 56 data bytes
(946756125)jffs2_get_inode_nodes(): Data CRC failed on node at 0x00a5e84c: Read 0xc95dbcf1, calculated 0x072fbe16

Please press Enter to activate this console. (946756125)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0078ea58: Read 0x15dfa329, calculated 0xe434b54e
(946756125)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0078e058: Read 0xc95dbcf1, calculated 0x95178f96
(946756126)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0078ce58: Read 0xc95dbcf1, calculated 0x95178f96
(946756126)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0061de58: Read 0x376ec35f, calculated 0x9c0093c0
(946756126)jffs2_get_inode_nodes(): CRC failed on node at 0x0061cfdc: Read 0xfff fffff, calculated 0xb97835b2
(946756126)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0061c000: Read 0x581d4522, calculated 0x32691c16
(946756126)jffs2_get_inode_nodes(): CRC failed on node at 0x012c25c4: Read 0xfff fffff, calculated 0xd2d4d182
(946756126)jffs2_get_inode_nodes(): Data CRC failed on node at 0x012c3944: Read 0x33f02626, calculated 0x2d022b39
(946756126)jffs2_get_inode_nodes(): Data CRC failed on node at 0x011a4664: Read 0xa31bb5ff, calculated 0x7dcac85f
(946756126)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0078c458: Read 0x20fce934, calculated 0x85098c7e
(946756126)jffs2_get_inode_nodes(): CRC failed on node at 0x0078f5ec: Read 0xfff fffff, calculated 0x81756b8b
(946756127)jffs2_get_inode_nodes(): Data CRC failed on node at 0x0061d4cc: Read 0x20fce934, calculated 0x95044465



BusyBox v1.00-pre3 (2007.03.30-22:08+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
J
Userlevel 2
The system says read-only file system when I attempt and upgrade or wget. Also is see the Rincon boot loader but then it gets to a busybox v1.00-pre3. Don't know if that is expected. It shows to be running the diag firmware.
J
Userlevel 2
Got it connected and recognized now in Sonos Software. Was able to update the firmware. The device I think though is dead....as it doesn't play any audio when speakers are attached. Any idea's where to start?
A
Userlevel 2
could you please tell us, for reference, how did you revive it? just to keep records in the forum for future people who might need it.
regarding your other issue, check the circuit boards. do a complete cleanup and make sure the audio amplifiers arent fried.
J
Userlevel 2
Sure.

I used a bus pirate connected to the zp100 which was booting in diag firmware. Setup the bus pirate to run uart mode. Setup Apache on my local workstion windows 8 and downloaded the 28.1-83040-1-1.upd file. Ran update http://169.254.1.2/28.1-83040-1-1.upd. Found that you had to kill anacapa service. Once that was killed the system updated. It booted with local ip address. I had to reboot holding the mute to reset the system then Sonos software would see it. Right now I get no audio and the box appears to freeze often........the timer will begin and then the box goes unresponsive. Where are the audio amplifies on the boards?
A
Userlevel 2
Sure.

I used a bus pirate connected to the zp100 which was booting in diag firmware. Setup the bus pirate to run uart mode. Setup Apache on my local workstion windows 8 and downloaded the 28.1-83040-1-1.upd file. Ran update http://169.254.1.2/28.1-83040-1-1.upd. Found that you had to kill anacapa service. Once that was killed the system updated. It booted with local ip address. I had to reboot holding the mute to reset the system then Sonos software would see it. Right now I get no audio and the box appears to freeze often........the timer will begin and then the box goes unresponsive. Where are the audio amplifies on the boards?

John
My revived used to freeze a lot. I ended up cleaning everthing with contact cleaner and marking sure every wire was connected tight. After doing that, it came back from death and is been running for almost a month now.
Apms are located on the right side of the unit.
J
Userlevel 2
andresmorago: I got it working 100%. So after the unit was freezing I took it apart and completely cleaned the inside. Everything now working 100%. Doing a little burn in on the system. Hopefully it all holds. Thanks for all of the help.
NoBoB
The device I think though is dead....as it doesn't play any audio when speakers are attached.

n/m...
A
Userlevel 2
andresmorago: I got it working 100%. So after the unit was freezing I took it apart and completely cleaned the inside. Everything now working 100%. Doing a little burn in on the system. Hopefully it all holds. Thanks for all of the help.
great to hear that. indeed, cleaning the house helps! it did for me too 🙂
S
Userlevel 2

Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help.
SDRAM test...
Memory test iteration 0
SDRAM test complete
Attempting to autoboot from NAND device
NAND ID is EC:75
32M NAND flash (Samsung K9F5608U0C) detected
Section 0 is provisionally good, kernel on partition 1, generation 15
Section 1 is provisionally good, kernel on partition 4, generation 14
Attempting to boot kernel from partition 1
(946756120)VFS: Mounted root (cramfs filesystem) readonly.
(946756120)Mounted devfs on /dev


I don't remember ever seeing above BOLD message before.
Do these messages appear after it booted with the updated firmware?
S
Userlevel 2
great to hear that. indeed, cleaning the house helps! it did for me too :)

What kind of cleaning are talking about hear? is just a matter of blowing compress air to rid of all the dust behind all the crevices?
A
Userlevel 2
What kind of cleaning are talking about hear? is just a matter of blowing compress air to rid of all the dust behind all the crevices?
yes. also electronic contacts cleaner and disconnecting/re-connecting all cables.
A
Userlevel 2
Hello all.
I received my play3 today. I finally got to the uart connector which is very small to solder.
i know play3 is much different than older zp units...still, kinda works similar.

i have been struggling trying to access any diags menu. it boots up so fast that i cant get it to stop.
this is what i get so far. everytime i power it up, it will get to a different point. still, non responsive with any keyboard commands.

code:

U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)

Reset Status:

CPU:   e300c3, MPC8314, Rev: 12 at 250 MHz, CSB:  125 MHz
Board: Sonos Fenway
I2C:   ready
DRAM:  (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.

NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND :
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND : ..
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND :
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Relocate failed
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND : .........
A
Userlevel 2
ok. got somewhere else after hitting the h key:


code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)

Reset Status:

CPU:   e300c3, MPC8314, Rev: 12 at 250 MHz, CSB:  125 MHz
Board: Sonos Fenway
I2C:   ready
DRAM:  (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
DRAM 32-bit Data Pattern Test AA ------------- PASSED
DRAM 32-bit Data Pattern Test 55 ------------- PASSED
DRAM Address Line Test ----------------------- PASSED
DRAM tests complete.
===================================================
PCIE0: Link
NAND:  64 MiB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   eTSEC1
Hit any key to stop autoboot:  0
=> hhhhhhhhhhhhhhhhhhhh
Unknown command 'hhhhhhhhhhhhhhhhhhhh' - try 'help'
=>
=>
=>
=> help
?       - alias for 'help'
audio   - Manage Audio Modulators
autoscr - run script from memory
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootgen - display partition's bootgen
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
buttons - Button monitoring
clocks  - print clock configuration
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
crc32   - checksum calculation
ddputil - Diagnostic Data Page utility
diag    - perform board diagnostics
echo    - echo args to console
exit    - exit script
format  - erases a partition and frees all physical blocks
go      - start application at address 'addr'
gpio    - GPIO initialization and register access
gtm     - GTM initialization and register access
help    - print online help
i2s     - Manage TDM/DMAC blocks
icrc32  - checksum calculation
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imm     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest   - return true/false on integer compare
jffs    - translates a logical offset to a physical offset
junctemp - display CPU's die temp
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
map     - translates a logical block number to a physical
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing)
motion  - Accelerometer monitoring
mtest   - simple RAM test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nfs     - boot image via network using NFS protocol
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
ptable  - partition table commands
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sleep   - delay execution for some time
sonosboot - Boot the freshest section (or optionally the least fresh)
temp    - display current temperature
test    - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
upgrade - Upgrade a partition from a raw file
vcxo    - Sweep VCXO and monitor modulator PLL lock
version - print monitor version


EDIT

ok. after spending a lot of time today, i think the NAND is fried since it will always gets stuck when doing some NAND work.

ive searched and that NAND is comercially saleable. is it worth it to try and replace it? if so, how do i program it?

code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)

Reset Status: Check Stop, External/Internal Soft, External/Internal Hard

CPU:   e300c3, MPC8314, Rev: 12 at 250 MHz, CSB:  125 MHz
Board: Sonos Fenway
I2C:   ready
DRAM:  (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
DRAM 32-bit Data Pattern Test AA ------------- PASSED
DRAM 32-bit Data Pattern Test 55 ------------- PASSED
DRAM Address Line Test ----------------------- PASSED
DRAM tests complete.
===================================================
PCIE0: Link
NAND:
A
Userlevel 2
i made it again to some kind of menu. tried to load sonos fw from flash and this is what i got:

code:
=> sonosboot
nand_read_sonos: flash read error -74, retlen 16384
Error reading partition table from flash, using default
both sections readable, bootgen-0 3, bootgen-1 2
section 0 selected
verifying section 0...check: page2048 (logicalBlock 11, physicalBlock 40 )is not readable

verification error with section 0, trying other section...check: page28672 (logicalBlock C41, physicalBlock 380 )is not readable

both sections are bad, abort
problem reading sections...attempting to boot section 0 anyway
booting section 0
nand_read_sonos: flash read error -74, retlen 16384
Error reading kernel from flash, abort
=>
=>
S
Userlevel 2
i made it again to some kind of menu. tried to load sonos fw from flash and this is what i got:

code:
=> sonosboot
nand_read_sonos: flash read error -74, retlen 16384
Error reading partition table from flash, using default
both sections readable, bootgen-0 3, bootgen-1 2
section 0 selected
verifying section 0...check: page2048 (logicalBlock 11, physicalBlock 40 )is not readable

verification error with section 0, trying other section...check: page28672 (logicalBlock C41, physicalBlock 380 )is not readable

both sections are bad, abort
problem reading sections...attempting to boot section 0 anyway
booting section 0
nand_read_sonos: flash read error -74, retlen 16384
Error reading kernel from flash, abort
=>
=>

Replacing the NAND chip may be the easy part provided that you know how to work in removing and replacing chip on circuit board.

But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.

Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
A
Userlevel 2
thanks.
indeed, soldering the new nand would be the easiest part.
eventhough i would feel comfortable working with JTAG, getting the kernel stored in the new chip will be tricky since noone has it.



Replacing the NAND chip may be the easy part provided that you know how to work in removing and replacing chip on circuit board.

But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.

Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
S
Userlevel 2
Haven't received the chip from China yet. Replacement, well, there's certainly a technique to replacing a 54 pin SMT chip.

upon further inspection, the chip, IS42S16800B-7T is a 16MB capacity only...and UART console show a 32M SDRAM config which mean there must be 2 chips. And this confirm by inspecting the board, there are 2 chips mount top/bottom joining together onto the board. So that mean we have to remove/replace both chips on top and bottom board!!!
J
Userlevel 2
Well, I have a couple of these ZP100s that do exactly as this thread describes... At first I was oh well, but after searching I found this forum. I now have a bus pirate on the way and I have a great hope that I'll get the ZPs working... Thanks to all that have made this information available... Hopefully, with a this great information The ZPs will be up running in short time once the bus pirate is received...

Wish me luck...

😉
J
Userlevel 2
Ok. So the one that I repaired is still going strong without issue. A buddy of mine bought two of them and one had a diag firmware.....got the newest firmware on that one easy. The second already was on the network. The one with Diag firmware will pair with the system but upon playing music will go orange light then white then orange. If you continue to hit the mute music will play for a second. The light means fault......is there a way to find the fault or clear it? The second unit will not pair at all. Any ideas?
Terms & ConditionsCookie settings